← Vulnerability feed

Vulnerability record · CVE-2020-36167 · published 6 January 2021

CVE-2020-36167: Veritas backup exec unrestricted file upload vulnerability

VVeritas · Backup Exec

An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix 298543, and 21.1 before hotfix 657517. On start-up, it loads the OpenSSL library from the Installation folder. This library in turn attempts to load the /usr/local/ssl/openssl.cnf configuration file, which may not exist. On Windows systems, this path could translate to <drive>:\usr\local\ssl\openssl.cnf. A low privileged user can create a :\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc. If the system is also an Active Directory domain controller, then this can affect the entire domain.

8.8 CVSS 3.1 High EPSS 0.46% · top 62.5% CWE-434 · Unrestricted file upload
8.8CVSS 3.1 base score, v2 7.2
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix 298543, and 21.1 before hotfix 657517. On start-up, it loads the OpenSSL library from the Installation folder. This library in turn attempts to load the /usr/local/ssl/openssl.cnf configuration file, which may not exist. On Windows systems, this path could translate to <drive>:\usr\local\ssl\openssl.cnf. A low privileged user can create a :\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc. If the system is also an Active Directory domain controller, then this can affect the entire domain.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.kb.cert.org/vuls/id/429301 Third Party AdvisoryUS Government Resource
https://www.veritas.com/content/support/en_US/security/VTS20-010 Vendor Advisory
https://www.kb.cert.org/vuls/id/429301 Third Party AdvisoryUS Government Resource
https://www.veritas.com/content/support/en_US/security/VTS20-010 Vendor Advisory

Track CVE-2020-36167 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-27877Veritas Backup Exec Agent improper authentication via legacy SHA schemeVeritas Backup Exec before 21.2 still supported a legacy SHA authentication scheme that should have been disabled. Because that scheme is weak, an un…KEVEPSS 65%analysed8.8CVE-2021-27878Veritas Backup Exec Agent SHA authentication bypass leading to command executionVeritas Backup Exec before 21.2 contains a flaw in the SHA authentication scheme used between client and Agent. An attacker can bypass authentication…KEVEPSS 24%analysed8.1CVE-2021-27876Veritas Backup Exec Agent authentication bypass enabling arbitrary file accessVeritas Backup Exec before 21.2 has a flaw in the SHA authentication scheme used between client and Agent. An attacker can bypass authentication and …KEVEPSS 14%analysed9.8CVE-2017-8895Veritas Backup Exec agents use-after-free allows remote code executionVeritas Backup Exec 2014, 15 and 16 contain a use-after-free flaw in multiple agents. An unauthenticated attacker can crash the agent or potentially …EPSS 71%analysed7.8CVE-2024-33673Veritas backup exec improper access control vulnerabilityAn issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijacking in the Windows DLL Search …EPSS 0.16%7.5CVE-2005-0772Veritas backup exec null pointer dereference vulnerabilityVERITAS Backup Exec 9.0 through 10.0 for Windows Servers, and 9.0.4019 through 9.1.307 for Netware, allows remote attackers to cause a denial of serv…EPSS 36%7.1CVE-2024-33671Veritas backup exec vulnerabilityAn issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leverag…EPSS 0.17%10.0CVE-2026-56291Balbooa Forms Joomla extension unauthenticated arbitrary file upload RCEThe Balbooa Forms extension for Joomla before version 2.4.1 accepts file uploads without authentication and does not restrict file type, allowing exe…KEVEPSS 15%analysed

Source: NIST National Vulnerability Database (record CVE-2020-36167), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.